CVE-2026-108955: Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds
A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function ggufinitfromfile of the file ggml.c of the component GGUF Parser. This manipulation of the argument dataoffset causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires local access and low privileges. No user interaction is required.
Is exploit code available publicly?
Yes. The exploit has been publicly disclosed and may be used.
How can I determine whether my PowerInfer deployment is affected?
The issue affects PowerInfer revisions up to commit 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Because PowerInfer uses rolling releases, affected or fixed release version numbers are not available.
Is a patched release available?
A pull request to fix the issue exists but is awaiting acceptance. The provided information does not identify an updated release containing the fix.